Merge pull request #8757 from Couchers-org/backend/feature/hide-moderator-badge

Backend: Hide moderator badge behind a feature flag

Author: aapeliv

app/backend/resources/badges.json

@@ -18,7 +18,8 @@
     {
       "id": "moderator",
       "color": "#c74f5b",
-      "admin_editable": false
+      "admin_editable": false,
+      "flag": "show_moderator_badge"
     },
     {
       "id": "volunteer",

app/backend/src/couchers/context.py

@@ -3,7 +3,6 @@
 import grpc
 
 from couchers import experimentation
-from couchers.config import config
 from couchers.i18n import LocalizationContext
 
 if TYPE_CHECKING:
@@ -181,29 +180,23 @@ def token(self) -> str:
     def localization(self) -> LocalizationContext:
         return self.__localization
 
-    # Feature-flag evaluation methods mirror the OpenFeature evaluation API. The in-code default is
-    # honored even for flags not yet set up in GrowthBook, since get_feature_value falls back to it.
+    # Feature-flag evaluation methods mirror the OpenFeature evaluation API, evaluating for this
+    # context's user. The gating lives in experimentation; we just pass our cached per-request
+    # evaluator. The in-code default is honored even for flags not yet set up in GrowthBook.
     def get_boolean_value(self, flag_key: str, default: bool) -> bool:
-        if config["EXPERIMENTATION_PASS_ALL_GATES"]:
-            return True
-        return self._get_feature_value(flag_key, default)
+        return experimentation._boolean_value(flag_key, default, self._get_growthbook)
 
     def get_string_value(self, flag_key: str, default: str) -> str:
-        return self._get_feature_value(flag_key, default)
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
 
     def get_integer_value(self, flag_key: str, default: int) -> int:
-        return self._get_feature_value(flag_key, default)
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
 
     def get_float_value(self, flag_key: str, default: float) -> float:
-        return self._get_feature_value(flag_key, default)
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
 
     def get_object_value[T](self, flag_key: str, default: T) -> T:
-        return self._get_feature_value(flag_key, default)
-
-    def _get_feature_value[T](self, flag_key: str, default: T) -> T:
-        if not config["EXPERIMENTATION_ENABLED"]:
-            return default
-        return self._get_growthbook().get_feature_value(flag_key, default)  # type: ignore[no-any-return]
+        return experimentation._feature_value(flag_key, default, self._get_growthbook)
 
     def _get_growthbook(self) -> GrowthBook:
         if self._growthbook is None:

app/backend/src/couchers/experimentation.py

@@ -3,15 +3,23 @@
 
 Uses GrowthBook under the hood, but abstracts the implementation details.
 
-Don't evaluate flags by calling into this module directly - go through the CouchersContext methods
-(context.get_boolean_value, get_string_value, etc.), which own the per-request evaluator cache and
-the enabled / pass-all-gates gating. The underscore-prefixed helpers here are internal to that
-wiring; setup_experimentation() is the only public entry point, called once at process startup.
+Two ways to evaluate a flag:
+  - Per-user/request: use the CouchersContext methods (context.get_boolean_value, get_string_value,
+    etc.), which evaluate for the context's user and own the per-request evaluator cache.
+  - Global (no user/request): use the module-level get_global_boolean_value / get_global_string_value
+    / ... below. Use these ONLY when there is genuinely no user to evaluate for and no way to thread
+    one through - per-user evaluation is impossible here, not merely that you don't expect the value
+    to vary per user. Whenever a user is (or could reasonably be) available, use the context: only the
+    per-user path can do percentage rollouts, experiments, and feature-usage tracking.
+
+Both paths share the enabled / pass-all-gates gating helpers here. setup_experimentation() is called
+once at process startup.
 """
 
 import json
 import logging
 import threading
+from collections.abc import Callable
 from typing import Any
 
 import urllib3
@@ -180,3 +188,49 @@ def on_feature_usage(key: str, result: FeatureResult, *args: Any, **kwargs: Any)
         on_experiment_viewed=on_experiment_viewed,
         on_feature_usage=on_feature_usage,
     )
+
+
+def _global_evaluator() -> GrowthBook:
+    """Build an anonymous evaluator for flag evaluation with no user/request context."""
+    return _create_evaluator(None)
+
+
+# These two helpers are the single home of the gating logic, shared by the global functions below
+# and by CouchersContext (which passes its own cached per-request evaluator). get_evaluator is only
+# invoked once gating passes, so it stays lazy.
+def _feature_value[T](flag_key: str, default: T, get_evaluator: Callable[[], GrowthBook]) -> T:
+    if not config["EXPERIMENTATION_ENABLED"]:
+        return default
+    return get_evaluator().get_feature_value(flag_key, default)  # type: ignore[no-any-return]
+
+
+def _boolean_value(flag_key: str, default: bool, get_evaluator: Callable[[], GrowthBook]) -> bool:
+    if config["EXPERIMENTATION_PASS_ALL_GATES"]:
+        return True
+    return _feature_value(flag_key, default, get_evaluator)
+
+
+# Global (no-user) flag evaluation. Use these ONLY when there is genuinely no user to evaluate for and
+# no way to thread one through - per-user evaluation is impossible here, not merely that you don't
+# expect the value to vary per user. If a user is (or could reasonably be) available, use the
+# CouchersContext methods instead: only the per-user path does percentage rollouts, experiments, and
+# feature-usage tracking. With no user to bucket, rollouts and experiments are skipped and flags fall
+# through to their in-code defaults unless a rule forces a value globally.
+def get_global_boolean_value(flag_key: str, default: bool) -> bool:
+    return _boolean_value(flag_key, default, _global_evaluator)
+
+
+def get_global_string_value(flag_key: str, default: str) -> str:
+    return _feature_value(flag_key, default, _global_evaluator)
+
+
+def get_global_integer_value(flag_key: str, default: int) -> int:
+    return _feature_value(flag_key, default, _global_evaluator)
+
+
+def get_global_float_value(flag_key: str, default: float) -> float:
+    return _feature_value(flag_key, default, _global_evaluator)
+
+
+def get_global_object_value[T](flag_key: str, default: T) -> T:
+    return _feature_value(flag_key, default, _global_evaluator)

app/backend/src/couchers/jobs/handlers.py

@@ -29,6 +29,7 @@
     update,
 )
 
+from couchers import experimentation
 from couchers.config import config
 from couchers.constants import (
     ACTIVENESS_PROBE_EXPIRY_TIME,
@@ -838,6 +839,9 @@ def update_badges(payload: empty_pb2.Empty) -> None:
 
         def update_badge(badge_id: str, members: Sequence[int]) -> None:
             badge = get_badge_dict()[badge_id]
+            # this batch job has no per-user context to evaluate the gate against, so it's global
+            if badge.flag is not None and not experimentation.get_global_boolean_value(badge.flag, default=True):
+                members = []
             user_ids = session.execute(select(UserBadge.user_id).where(UserBadge.badge_id == badge.id)).scalars().all()
             # in case the user ids don't exist in the db
             actual_members = session.execute(select(User.id).where(User.id.in_(members))).scalars().all()

app/backend/src/couchers/resources.py

@@ -77,6 +77,9 @@ class Badge:
     id: str
     color: str
     admin_editable: bool
+    # if set, the badge is only awarded while this feature flag is on (the flag defaults to on, so
+    # the badge keeps being awarded until the flag is turned off)
+    flag: str | None = None
 
 
 @functools.cache

app/backend/src/tests/test_bg_jobs.py

@@ -10,6 +10,7 @@
 from sqlalchemy.sql import delete, func
 
 import couchers.jobs.worker
+from couchers import experimentation
 from couchers.config import config
 from couchers.constants import HOST_REQUEST_MAX_REMINDERS, HOST_REQUEST_REMINDER_INTERVAL
 from couchers.crypto import urlsafe_secure_token
@@ -1342,6 +1343,50 @@ def test_update_badges(db, push_collector: PushCollector):
     assert push.content.body == "The Verified Phone badge was added to your profile."
 
 
+def test_update_badges_awards_moderator_to_superuser(db):
+    """The show_moderator_badge flag defaults on, so superusers are awarded the moderator badge."""
+    superuser, _ = generate_user(is_superuser=True, last_donated=None)
+
+    update_badges(empty_pb2.Empty())
+
+    with session_scope() as session:
+        assert (
+            session.execute(
+                select(func.count())
+                .select_from(UserBadge)
+                .where(UserBadge.user_id == superuser.id, UserBadge.badge_id == "moderator")
+            ).scalar()
+            == 1
+        )
+
+
+def test_update_badges_skips_moderator_when_flag_off(db, monkeypatch):
+    """With show_moderator_badge forced off, superusers are not awarded the moderator badge."""
+    # force show_moderator_badge off for everyone (force rule with no coverage applies globally)
+    monkeypatch.setattr(experimentation, "_initialized", True)
+    monkeypatch.setattr(
+        experimentation,
+        "_state",
+        {"features": {"show_moderator_badge": {"defaultValue": True, "rules": [{"force": False}]}}, "savedGroups": {}},
+    )
+    monkeypatch.setitem(config, "EXPERIMENTATION_ENABLED", True)
+    monkeypatch.setitem(config, "EXPERIMENTATION_PASS_ALL_GATES", False)
+
+    superuser, _ = generate_user(is_superuser=True, last_donated=None)
+
+    update_badges(empty_pb2.Empty())
+
+    with session_scope() as session:
+        assert (
+            session.execute(
+                select(func.count())
+                .select_from(UserBadge)
+                .where(UserBadge.user_id == superuser.id, UserBadge.badge_id == "moderator")
+            ).scalar()
+            == 0
+        )
+
+
 def test_send_request_notifications_blocked_users_no_notification(db, moderator):
     """
     Regression test: send_request_notifications should not send notifications

app/backend/src/tests/test_experimentation.py

@@ -96,3 +96,16 @@ def test_record_feature_usage_none_value(db):
         rows = _get_usage(session, 1)
         assert len(rows) == 1
         assert rows[0].value is None
+
+
+def test_global_evaluation_excluded_from_rollout_gets_feature_default(experimentation_snapshot):
+    # global (no-user) evaluation can't bucket into a rollout, so it gets the feature default
+    assert experimentation.get_global_string_value("rollout_flag", "fallback") == "control"
+
+
+def test_global_evaluation_gets_global_force_on_flag(experimentation_snapshot):
+    assert experimentation.get_global_boolean_value("global_flag", default=False) is True
+
+
+def test_global_evaluation_unknown_feature_returns_in_code_default(experimentation_snapshot):
+    assert experimentation.get_global_string_value("does_not_exist", "my_default") == "my_default"